Privacy Protection Statement

I. Legal Basis for Collection, Processing, and Utilization of Customer Data:

1. The Company collects, processes, and utilizes your personal data in accordance with the provisions of the Personal Data Protection Act, including:
   • Data provided by you when joining the Company's membership.
   • Data related to contracts or similar agreements with you, such as sample collection and distribution conducted by the Company.
   • Data required by explicit legal provisions that mandate the Company to collect, process, or utilize.
   • Data publicly disclosed by you or lawfully made public, although the Company does not actively collect, process, or utilize such data.
   • Data processed only as necessary and limited for maintaining information security, preventing fraud, and other legitimate interests.
   • Data processed only to the extent necessary and reasonable to verify the purpose of data collection by the Company, without infringing on your rights.

II. Types of Customer Data Collected:

1. Basic Information: Includes your provided name, contact phone number, address, email address, and other voluntarily provided information.
2. Information required when using sample collection services, including clinic name, contact phone number, address, simplified serial number (including but not limited to QR code), and other necessary contact information for distribution.
3. Data shared by you through devices or internet connections, such as granting us access to device GPS location, photos, and other related metadata, IP location, cookies, and similar technical data, and relevant data from connected networks.

III. Purposes of Customer Data Collection:

The Company only utilizes your personal data for necessary operational purposes such as providing sample collection and distribution market analysis, membership benefits notifications, and other associated services:

1. Sample Collection and Distribution: We provide sample collection and finished product distribution services as part of our contractual obligations, sharing sample collection data with cooperating operators or logistics companies.
2. For providing accurate services, we statistically analyze the contents of collected surveys. Analysis results will be presented as aggregated data or explanatory text. Except for internal research purposes, we may publish the data and explanatory text as needed, without involving specific personal information.

IV. Duration and Geographic Scope of Customer Data Utilization:

• We utilize customer data within the scope of service purposes specified above, during the duration of your membership and within the service accessible areas, except under the following circumstances:
  1. Explicit legal provisions.
  2. Necessary for the public interest.
  3. To prevent risks to life, body, freedom, or property of individuals.
  4. To prevent significant harm to the rights and interests of others.
  5. With the consent of the individuals concerned.
  6. Beneficial to the rights and interests of the individuals concerned.

V. Transfer and Disclosure of Customer Data, Recipients, and Methods:

1. Your personal data is primarily received by the Company, and we only disclose personal data to third parties (such as cooperative manufacturers, logistics companies, and related business entities) entrusted by the Company to handle business-related matters, based on your explicit consent and within the scope of service purposes specified above.
2. Unless otherwise prescribed by laws or with your consent, we will not disclose your personal data to third parties other than those mentioned above, except when it has a significant impact on your rights, serves the public interest, or is conducted for marketing purposes with your consent. In such cases, the Company will not actively contact you.
3. Situations where we provide data to other third parties, in addition to the customer's consent, may include:
   • Necessary for operations within the specified purpose scope.
   • Utilization beyond the scope specified by Article 20, Paragraph 2 of the Personal Data Protection Act.
   • Based on legal requirements or requests from judicial and other competent authorities in accordance with legal procedures.
   • In emergency situations to safeguard the legitimate rights and interests of other members or third parties.
   • To maintain the normal operation of member service systems.
   • Necessary information about gold/material logistics generated by members through this service.

VI. Duration and Storage Security of Customer Data:

1. The personal data you provide will be continuously retained for the duration of providing various membership services to you, until you delete your account or until you exercise relevant personal rights.
2. Our system is equipped with information security equipment and necessary security measures. Strict protection measures are adopted for the personal data you provide, which can only be accessed by authorized personnel. Relevant processing personnel have signed confidentiality agreements, and violations will be subject to relevant legal sanctions.
3. Regarding the personal data you provide, we will establish strict regulations on information systems and company operations. Anyone must process and utilize necessary data only under the authorization regulations defined by us.

VII. Exercise of Customer Data Rights:

• According to Article 3 of the Personal Data Protection Act, unless limited by other laws, you have the right to inquire about or request access to, request copies of, request supplementation or correction of, request cessation of collection, processing, or utilization of (including withdrawing consent, objecting to the Company's continued processing of your data), and request deletion of your personal data.
• If you wish to exercise the above rights or have other inquiries or complaints, you can contact the Company to provide feedback, and we will respond to your questions as soon as possible.
• The Company will handle your exercise of personal rights. For inquiries or requests for access, the Company will respond within 15 working days from the date of the request, with the option to extend by another 15 working days if necessary, with written notification of the reason for the extension. For requests for supplementation or correction, cessation of collection, processing, or utilization, or deletion, the Company will respond within 30 working days from the date of the request, with the option to extend by another 30 working days if necessary, with written notification of the reason for the extension.

VIII. Impact of Data Accuracy on Rights and Interests:

• We remind you that if customers do not provide complete personal data, they may not be able to become our members or enjoy various corresponding membership benefits or latest information. If the data provided by customers is incorrect, the Company is not bound by this statement. Customers may also request cessation or deletion of personal data belonging to them, but once ceased or deleted, you will no longer be able to use any services provided by the Company.

IX. Contact Information:

• If you have any questions regarding this Privacy Protection Statement, please contact the Company.

X. Modification of Privacy Statement:

• Regarding this Privacy Statement, we may modify it at any time in response to changes in the social environment, legal requirements, and technological advancements, and we will notify customers of the modifications through email, phone, catalogs, communication networks, website announcements, or other appropriate means. When you download, install, or continue to use any service provided by the platform, and confirm the privacy and membership-related terms, it indicates that you have read, understood, and agreed to accept all the contents of this Service Agreement.